Privacy Policy

1. Your Privacy: Overview
This privacy policy (this “Privacy Policy”) tells you about the information that Sequoia Benefits and Insurance Services, LLC (“Sequoia,” “we,” “us” or “our”) collects in connection with the operation of our website located at https://www.sequoia.com and all related online services offered by Sequoia as well as data we collect offline (collectively, the “Service”), how the information is used and disclosed and rights you may have to such information.

Please note that this Privacy Policy applies only to information collected from you by Sequoia via the Service except as provided below. This Privacy Policy does not apply to information we process as a data processor or service provider on behalf of our clients. For example, we may, on behalf of your employer, process your information to help your employer manage benefits within the employer’s organization. Sequoia does not control how client use information Sequoia processes on their behalf, and you should consult with the applicable client to understand how they use information they receive from Sequoia.

Further, the Service may contain links to other entities’ websites that are not controlled or operated by Sequoia. This Privacy Policy does not apply to such third party websites, and Sequoia is not responsible for the content of such third party websites or the privacy practices of such third parties. Therefore, we encourage you to request and review the privacy policies of any third parties upon disclosing your information to such parties or visiting such third party websites.

This Privacy Policy is effective as of July 31, 2024

2. Collection of Your Information

We collect information in multiple ways, including when you provide information directly to us, when we passively collect information from you (such as from your browser or device), and from other parties.

A. Information You Provide to Us Directly

We may collect information from you directly in various ways, such as when you:

• Inquire about our Service;
• Register for an account;
• Fill out a survey;
• Provide us with feedback;
• Post content, including posting in any message board, chat room, or messenger functionality on the Service;
• Request information or assistance;
• Request certain features (e.g., newsletters, updates, and other products); or
• Otherwise communicate with us, including through in person at events or conferences.

The information that Sequoia collects may include your name, username, password, email address, address and telephone number and any other information that you choose to include in your account profile or in your submissions to us.

You are not required to provide us with such information, but certain features of the Service may not be accessible or available absent the provision of the requested information.

B. Information We Collect Automatically

We and our third-party vendors, which include ad networks and analytics companies such as Google Analytics, may use cookies, web beacons, and other tracking technologies to collect information about the computers or devices (including mobile devices) you use to access the Service. As described further below, we may collect and analyze information including but not limited to (a) browser type; (b) ISP or operating system; (c) domain name; (d) access time; (e) referring or exit pages; (f) page views; (g) IP address; (h) unique device identifiers (e.g. IDFA or Android ID); (i) version of our Service you’re using; and (j) the type of device that you use. We may also track when and how frequently you access or use the Service, including how you engage with or navigate our site or mobile application. We may use this information (including the information collected by our third-party vendors) for analytics (including to determine which portions of the Service are used most frequently and what our users like/do not like), to evaluate the success of any advertising campaigns, and as otherwise described in this Privacy Policy.

We and our third-party vendors may use cookies, clear GIFs, pixel tags, and other technologies that help us better understand user behavior, personalize preferences, perform research and analytics, and improve the Service. These technologies, for example, may allow us to tailor the Service to your needs, save your password in password-protected areas, track the pages you visit, help us manage content, and compile statistics about usage of our Service. We or our third-party vendors also may use certain of these technologies in emails to our clients to help us track email response rates, identify when our emails are viewed, and track whether our emails are forwarded.

Most web browsers automatically accept cookies, but your browser may allow you to modify your browser settings to decline cookies if you prefer. If you disable cookies, you may be prevented from taking full advantage of the Services, because the Services may not function properly. As we adopt additional technologies, we may also gather additional information through other methods. For more information, see https://www.allaboutcookies.org/.

When you use the Service, we may collect general location information (such as general location inferred from an IP address).

For more information about how we use cookies, please visit our Cookie Statement.

C. Information We Collect From Other Parties

We may also collect information about you from other parties, such as when you are referred to us by another user. We may also receive information about you from third party social platforms, such as Facebook, when you interact with our social media profiles.

When your employer signs up to use the Service, your employer may provide information about you, such as your name, email address, and eligibility, so that we can contact you about signing up to use the Service under your employer’s account.

We may also obtain information about you, such as business-related information, from various third parties, such as marketers, data brokers, and researchers.

3. How We Use Information About You

Sequoia may use the information we collect for the following purposes:

• To provide any requested information, products or services;
• To troubleshoot problems with the Service;
• To find and prevent fraud, and respond to trust and safety issues that may arise;
• To customize your experience on the Service;
• To communicate with you, including to communicate with you about changes to our terms, conditions, or policies;
• To analyze, maintain, improve, modify, customize, and measure the Service;
• To develop new services;
• To protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other parties, including to enforce our product terms or compliance with this Privacy Policy;
• To detect and prevent fraud, criminal activity, or misuses of our Service, and to ensure the security of our IT systems, architecture, and networks;
• To comply with applicable laws and regulations or requested by any judicial process or governmental agency; or
• For marketing and advertising purposes, such as developing and providing promotional and advertising materials that may be relevant, valuable or otherwise of interest to you.

We may combine information that we collect from you through the Service with information that we obtain from other sources. We may also aggregate and/or de-identify information collected through the Service. We may use and disclose de-identified or aggregated data for any purpose, including without limitation for research and marketing purposes.

4. When We Disclose Information About You

We may disclose information about you in any of the following circumstances:

• Affiliates. We may disclose information to our subsidiaries and other affiliates, meaning an entity that controls, is controlled by, or is under common control with Sequoia. Our affiliates may use the information we disclose in a manner consistent with this Privacy Policy.

• Vendors. We may disclose information to vendors we retain to provide services on our behalf, including support services, website services, delivering promotional materials, answering client questions about our services and new services, fraud prevention, and legal services.

• Advertising Partners. We work with third party advertising partners to show you ads that we think may interest you. These advertising partners may set and access their own cookies, pixel tags and similar technologies on our Service and they may otherwise collect or have access to information about you which they may collect over time and across different online services. For more information, please review Section 9 (Choice and Opt-Out Preferences) below.

• Merger, Sale, or Other Asset Transfers. We may transfer your information to service providers, advisors, potential transactional partners, or other third parties in connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company or we sell, liquidate, or transfer all or a portion of our assets. The use of your information following any of these events will be governed by the provisions of this Privacy Policy in effect at the time the applicable information was collected.

• Legal Requirements. Sequoia reserves the right to disclose information about you if required to do so by law or legal process or otherwise requested by any law enforcement officer or agency acting under color of law.

• Protection of Sequoia and Others. Sequoia reserves the right to disclose information about you based on the good faith belief that such action is necessary or appropriate to: (a) protect and defend the rights or property of Sequoia, including to enforce our Terms of Service, or (b) protect the rights, property, safety or security of the public, our agents and affiliates, our employees, or of users of the Sequoia products and the Service.

• With Your Consent or At Your Direction. We may disclose your information to other parties based on your consent to do so. For example, if you post content in areas of the Service that are visible to others, you are directing us to make that information available publicly, or request a quote or service through us for our partners, you are directing us to disclose information about you to them.

5. Consent to Cross-Border Data Transfers

If you choose to use our Service from regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your information outside of those regions to the U.S. for storage and processing, which may not have the same data protection laws as your jurisdiction. When we transfer your information to the U.S., we take steps to comply with applicable data protection law, in particular legal requirements regarding adequate protection for data transfers. Also, we may transfer your data from the U.S. to other countries or regions in connection with storage and processing of data, fulfilling your requests, and operating our Service. By using the Service or otherwise providing us with any information, you consent to such transfer, storage, and processing in and to the United States and other applicable countries in which the privacy laws may not be as comprehensive as, or equivalent to, those in the country where you reside and/or are a citizen.

6. Protection of Your Information

To prevent unauthorized access or disclosure, maintain data accuracy and facilitate the appropriate use of information, Sequoia uses physical, technological and administrative procedures to attempt to protect the personally identifiable information we collect through the Service. Nevertheless, Internet transmissions are never completely private or secure. You understand that any messages or information you send to the Service may be read or intercepted by others. If you have any questions about the security of personally identifiable information collected by Sequoia, please contact us at: contactus@sequoia.com.

7. Privacy Notice for California Residents

A. Applicability and Scope
This California Consumer Privacy Act Notice (“Notice”) supplements our other privacy policies or notices. It applies to “Consumers” as defined by the California Consumer Privacy Act (as amended, the “CCPA”) from whom we collect Personal Information as a “business” as defined by the CCPA. In the event of a conflict between any Sequoia policy (including other sections of this Privacy Policy), statement or notice and this Notice, this Notice will prevail as to Consumers and their rights under the CCPA.

B. Categories of PI Collected, Used, and Disclosed
In the twelve months leading up to the effective date of this Notice, we have collected and disclosed the categories of PI described in Section 2 above for business or commercial purposes. The categories of personal information are:

• Identifiers, which may include a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, or driver’s license number
• Personal Records (listed in Cal. Civil Code § 1798.80(e)), which may include physical characteristics or description, signature, telephone number, education, employment, employment history, insurance policy number, bank account number, or any other financial information, medical information, or health insurance information.
• Consumer Characteristics, which may include sex, marital status, religion, veteran status, familial status, ethnicity, or disability.
• Customer Account Details/Commercial Information, which may include products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Internet Usage Information, which may include browsing history, search history, or information regarding your interaction with an Internet Web site, application, or advertisement.
• General Location Data, a general location such as that inferred from an IP address.
• Sensory Data, which may include audio recordings of customer calls, electronic, visual, or similar information.
• Professional or Employment Information, which may include professional, educational, or employment-related information.
• Sensitive PI, as defined by the CCPA, namely (1) account log-in and password or other credentials that allow access to your account; and (2) health information.

We obtain the above PI from the sources identified in Section 2. We use the above PI for the business purposes set forth in Section 3. We also disclose the above PI for the purposes set forth in Section 4.

C. Selling or Sharing Your PI
We do not sell PI to third parties: we’re not a data broker and we don’t put PI on the open market. However, we may share online identifiers (e.g. cookie data, IP addresses, device identifiers, general location information, and usage information) with analytics partners to help us analyze and understand use of the Service, and with certain advertising partners to engage in advertising, which under the CCPA could be characterized as “selling,” or “sharing,” of your PI. If you or your authorized agent would like to opt out of our “selling” or “sharing” of your information for such purposes, please see the subsection “Your Rights under the CCPA” below.

We do not have actual knowledge of selling or sharing for cross-context behavioral advertising the PI of consumers under the age of 16.

D. Your Rights under the CCPA
We provide Consumers with the privacy rights described in this section. You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and related regulations. As permitted by the CCPA, any request you or your authorized agent submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”) via the email listed below. This process may consist of, but is not limited to, our verifying your identity through established protocols, or our asking you to confirm information previously submitted to Sequoia.

To the extent permitted by law, we may deny your CCPA request where we are unable to reasonably verify you are the Consumer about whom we collected PI.

If we cannot comply with a request, we will explain the reasons in our response. You are not required to create an account with us to make a Verifiable Consumer Request.

Your Consumer privacy rights are as follows:

The Right to Know
You have the right to send us a request for:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The business or commercial purposes for our collecting your PI.
• The business or commercial purposes for “selling” or “sharing” your PI.
• The categories of other parties to whom we disclose your PI.
• The specific pieces of PI we have collected about you.
• A list of the categories of PI “sold” or “shared” about you in the prior 12 months if any. If we “sold” or “shared” your PI, we will explain:

o The categories of your PI we have “sold” or “shared” .
o The categories of third parties to which we have “sold” or “shared” your PI.

Opt Out of Sale or Sharing of Your PI
As noted above, we sell or share your PI as defined under the CCPA. If you want to opt out of such data sharing, please click on the cookie banner at the bottom of our webpage, where you will be able to manage cookies that may collect and share your PI in a manner that could be considered a sale or sharing under the CCPA. If you would like to opt out of the sale or sharing of your PII, ensure the toggle for “Sale of Personal Data” or toggles for “Performance Cookies” and “Targeting Cookies”, as applicable, are set to off.

Correct
You have the right to request correction of inaccurate PI that we maintain about you.

Delete
You have the right to request deletion of certain information that we maintain about you.

Non-Discrimination and Financial Incentive Programs
We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

Exclusions
Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your CCPA rights. For example, certain information may be exempt from such requests under applicable law or we may retain certain information for legal compliance and to secure our Services. We may need certain information in order to provide the Services to you; if you ask us to delete it, you may no longer be able to use the Services.

E. Retention of Personal Information About You
The personal information that we maintain about you will be stored and maintained by Sequoia until you instruct us otherwise, or, in Sequoia’s sole discretion, for the longer of: (a) for so long as is necessary or appropriate to carry out the purpose(s) for which such information was collected and (b) for so long as we are required or allowed to maintain such information by law or other applicable rules or regulations. Our retention of information is based on many factors such as your relationship Sequoia or our clients, the nature of the information, compliance with our legal obligations, and defending or resolving actual or anticipated legal claims.

F. Do-Not-Track Notice
We do not respond to browser-initiated Do Not Track signals, as the Internet industry is currently still working on Do Not Track standards, implementations, and solutions.

G. Contact Information and Making Requests
Sequoia welcomes questions and comments about this Notice and your California privacy rights. Questions, comments and requests should be directed to Sequoia’s privacy policy compliance department via email at contactus@sequoia.com.

8. Children’s Privacy

Sequoia recognizes the privacy interests of children and we encourage parents and guardians to take an active role in their children’s online activities and interests. The Service is not intended for children under the age of 16. Sequoia does not target its Service to children under 16. Sequoia does not knowingly collect personally identifiable information from children under the age of 16. In addition, if we discover that an individual under 13 has provided us with “personal information,” as defined in the Children’s Online Privacy Protection Act (“COPPA”), we will close the account and delete the personal information to the extent required by COPPA. We may, where permitted by law, retain certain information internally for purposes described in this Privacy Policy.

9. Choice and Opt-Out Preferences

We offer you certain choices regarding the collection, use, and disclosure of information about you.

If you prefer not to receive further marketing email communications from Sequoia (except in connection with information, products or services that you specifically request), you will have the ability to unsubscribe from such communications by means of a link provided in every broadcast email that is sent to you by Sequoia. Please note that if you unsubscribe from marketing emails, we may still send you administrative emails regarding the Services, including, for example, notices of updates to our Terms of Service or this Privacy Policy.

Cookies and Analytics.

• Analytics: We may use third-party web analytics services on the Service, such as those of Google Analytics. These vendors use the sort of technology described in the “Information We Collect Automatically” section above to help us analyze how users use the Service, including by noting the third-party website from which you arrive. The information collected by such technology will be disclosed to or collected directly by these vendors, who use the information to evaluate your use of the Service. We also may use Google Analytics for certain purposes related to advertising, as described in the following section. To prevent Google Analytics from using your information for web analytics, you may install the Google Analytics Opt-Out Browser Add-on.

• Advertising: We may allow third-party advertising networks to place cookies or other tracking technologies on your computer, mobile phone, or other device to collect information about your use of the Service in order to (a) inform, optimize, and serve marketing content based on past visits to our website and other online services and (b) report how our marketing content impressions and interactions with these marketing impressions are related to visits to our online services. We may also allow other unaffiliated parties (e.g., ad networks and ad servers such as Google Analytics) to serve tailored marketing to you and to access their own cookies or other tracking technologies on your computer, mobile phone, or other device you use to access the Service. You may receive tailored advertising on your computer through a web browser. Cookies may be associated with de-identified data linked to or derived from data you voluntarily have submitted to us (e.g., your email address) that we may disclose to a vendor in hashed, non-human-readable form. Some of our advertising partners are members of the Network Advertising Initiative (http://optout.networkadvertising.org/?c=1#!/) or the Digital Advertising Alliance (http://optout.aboutads.info/?c=2&lang=EN). If you do not wish to receive personalized ads, please visit their opt-out pages to learn about how you may opt out of receiving web-based personalized ads from member companies. You can access any settings offered by your mobile operating system to limit ad tracking, or you can install the AppChoices mobile app to learn more about how you may opt out of personalized ads in mobile apps. Please note that to the extent advertising technology is integrated into the Service, you may still receive advertising content even if you opt out of tailored advertising. In that case, the advertising content may not be tailored to your interests. Also, we do not control any of the above opt-out links and are not responsible for any choices you make using these mechanisms or the continued availability or accuracy of these mechanisms. If your browsers are configured to reject cookies when you visit these opt-out pages, or you subsequently erase your cookies, or use a different computer or change web browsers, your opt-out may no longer be effective.

10. European and United Kingdom Addendum

A. Legal Basis

Seqouia is considered the “data controller” of the “personal data” (as defined under the General Data Protection Regulation) we handle under this Privacy Policy. In other words, Sequoia is responsible for deciding how to collect, use, and disclose personal data, subject to applicable law. The laws of the European Economic Area and the United Kingdom require data controllers to tell you about the legal ground that they rely on for using, sharing, or disclosing your personal data. To the extent those laws apply, our legal grounds are as follows:

• Consent. We may process your personal data where you have consented to certain processing of your personal data. If we collect and process your personal data with your consent, you may withdraw your consent at any time. Withdrawal of your consent will not affect the lawfulness of any processing we have made prior to your withdrawal, nor will it affect the processing of your personal data carried out on the basis of legal grounds other than consent processing.

• Contractual Necessity. We may process your personal data as necessary to perform our obligations pursuant to a contract (or pending contract) with you. For example, we will process your personal data to comply with our agreements with you, and to honor our commitments in any contracts that we have with you.

• Compliance with a Legal Obligation. We may process your personal data where we have a legal obligation to do so. For example, we may process your personal data to comply with tax, labor and accounting obligations.

• Legitimate Interests. We may process your personal data where we or a third party have a legitimate interest in processing your personal data. Specifically, we have a legitimate interest in using your personal data for product development and internal analytics purposes, and otherwise to improve the safety, security, and performance of our Service. We only rely on our or a third party’s legitimate interests to process your personal data when these interests are not overridden by your rights and interests.

B. European and United Kingdom Privacy Rights

If you are located in the European Economic Area or the United Kingdom, you have the right to access the personal data we hold about you. In addition, you have the right to ask that we rectify any errors in your personal data when it is incorrect or inaccurate, and to exercise your right to erasure, portability and to restriction of processing when these rights are not incompatible with other legal obligations. For all marketing communications, you can opt-out any time and free of charge. The right to object for other processing activities will be balanced to ensure that it is not incompatible with local regulations or our legitimate interests. Please note that, prior to any response to the exercise of such rights, we may require you to provide reasonable information to verify your identity. In addition, we may have valid legal reasons to refuse your request, and will inform you if that is the case. Please note that there are exceptions and limitations to each of these rights, and that while any changes you make will be reflected in active user databases instantly or within a reasonable period of time, we may retain personal data for backups, archiving, prevention of fraud and abuse, analytics, satisfaction of legal obligations, or where we otherwise reasonably believe that we have a legitimate reason to do so. You may exercise these rights by contacting us using the contact details at the end of this Privacy Policy. You also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

11. Your Acceptance of This Privacy Policy and Revisions to This Privacy Policy

Upon signing up for the Service, you affirmatively consented to the terms of this Privacy Policy. If you do not agree to this Privacy Policy, you may not use the Service. Sequoia reserves the right, in our discretion, to change, modify, add or remove portions of this Privacy Policy at any time and from time to time and we will provide notice of those changes to you. We urge you to review this Privacy Policy frequently for changes. Your continued use of the Service means that you accept those changes.

12. Questions or Comments

Sequoia welcomes questions and comments about this Privacy Policy. For CCPA-related requests, you may contact us as provided in Section 7 of this Privacy Policy. All other questions or comments should be directed to Sequoia’s privacy policy compliance department:

Via email: contactus@sequoia.com

Via U.S. Mail:

Sequoia Benefits and Insurances Services, LLC
1850 Gateway Drive
Suite 700
San Mateo, CA 94404